CVE-2024-54001

Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fields application_language, application_date_format,application_timezone and application_time_format allow arbirary user input which is reflected. The vulnerability can become xss if the user input is javascript code that bypass CSP. This vulnerability is fixed in 1.2.41.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/kanboard/kanboard/security/advisories/GHSA-4vvp-jf72-chrj	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:kanboard:kanboard:1.2.40:*:*:*:*:*:*:*

History

17 Jun 2026, 08:09

Type	Values Removed	Values Added
CWE		CWE-79
CPE		cpe:2.3:a:kanboard:kanboard:1.2.40:::::::*
Summary		(es) Kanboard es un software de gestión de proyectos que se centra en la metodología Kanban. Se puede inyectar y almacenar HTML en la sección de configuración de la aplicación. Los campos application_language, application_date_format,application_timezone y application_time_format permiten la entrada arbitraria del usuario, que se refleja. La vulnerabilidad puede convertirse en xss si la entrada del usuario es código javascript que omite CSP. Esta vulnerabilidad se solucionó en 1.2.41.
First Time		Kanboard Kanboard kanboard
References	~~() https://github.com/kanboard/kanboard/security/advisories/GHSA-4vvp-jf72-chrj -~~	() https://github.com/kanboard/kanboard/security/advisories/GHSA-4vvp-jf72-chrj - Exploit, Vendor Advisory

05 Dec 2024, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-05 16:15

Updated : 2026-06-17 08:09

NVD link : CVE-2024-54001

Mitre link : CVE-2024-54001

CVE.ORG link : CVE-2024-54001

JSON object : View

Products Affected

kanboard

kanboard

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-54001", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-54001", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-05T16:40:28.043861Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "kanboard", "product": "kanboard", "versions": [{"status": "affected", "version": "< 1.2.41"}]}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "affectedData": [{"cpes": ["cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*"], "vendor": "kanboard", "product": "kanboard", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.41", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2024-12-05T16:15:26.650", "references": [{"url": "https://github.com/kanboard/kanboard/security/advisories/GHSA-4vvp-jf72-chrj", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-80"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fields application_language, application_date_format,application_timezone and application_time_format allow arbirary user input which is reflected. The vulnerability can become xss if the user input is javascript code that bypass CSP. This vulnerability is fixed in 1.2.41."}, {"lang": "es", "value": "Kanboard es un software de gesti\u00f3n de proyectos que se centra en la metodolog\u00eda Kanban. Se puede inyectar y almacenar HTML en la secci\u00f3n de configuraci\u00f3n de la aplicaci\u00f3n. Los campos application_language, application_date_format,application_timezone y application_time_format permiten la entrada arbitraria del usuario, que se refleja. La vulnerabilidad puede convertirse en xss si la entrada del usuario es c\u00f3digo javascript que omite CSP. Esta vulnerabilidad se solucion\u00f3 en 1.2.41."}], "lastModified": "2026-06-17T08:09:38.480", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kanboard:kanboard:1.2.40:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4FB7A069-3FD0-41E0-930F-DAB3B1E9E814"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}